1*a7c91847Schristos /* xsize.h -- Checked size_t computations.
2*a7c91847Schristos
3*a7c91847Schristos Copyright (C) 2003 Free Software Foundation, Inc.
4*a7c91847Schristos
5*a7c91847Schristos This program is free software; you can redistribute it and/or modify
6*a7c91847Schristos it under the terms of the GNU General Public License as published by
7*a7c91847Schristos the Free Software Foundation; either version 2, or (at your option)
8*a7c91847Schristos any later version.
9*a7c91847Schristos
10*a7c91847Schristos This program is distributed in the hope that it will be useful,
11*a7c91847Schristos but WITHOUT ANY WARRANTY; without even the implied warranty of
12*a7c91847Schristos MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13*a7c91847Schristos GNU General Public License for more details.
14*a7c91847Schristos
15*a7c91847Schristos You should have received a copy of the GNU General Public License
16*a7c91847Schristos along with this program; if not, write to the Free Software Foundation,
17*a7c91847Schristos Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
18*a7c91847Schristos
19*a7c91847Schristos #ifndef _XSIZE_H
20*a7c91847Schristos #define _XSIZE_H
21*a7c91847Schristos
22*a7c91847Schristos /* Get size_t. */
23*a7c91847Schristos #include <stddef.h>
24*a7c91847Schristos
25*a7c91847Schristos /* Get SIZE_MAX. */
26*a7c91847Schristos #include <limits.h>
27*a7c91847Schristos #if HAVE_STDINT_H
28*a7c91847Schristos # include <stdint.h>
29*a7c91847Schristos #endif
30*a7c91847Schristos
31*a7c91847Schristos /* The size of memory objects is often computed through expressions of
32*a7c91847Schristos type size_t. Example:
33*a7c91847Schristos void* p = malloc (header_size + n * element_size).
34*a7c91847Schristos These computations can lead to overflow. When this happens, malloc()
35*a7c91847Schristos returns a piece of memory that is way too small, and the program then
36*a7c91847Schristos crashes while attempting to fill the memory.
37*a7c91847Schristos To avoid this, the functions and macros in this file check for overflow.
38*a7c91847Schristos The convention is that SIZE_MAX represents overflow.
39*a7c91847Schristos malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
40*a7c91847Schristos implementation that uses mmap --, it's recommended to use size_overflow_p()
41*a7c91847Schristos or size_in_bounds_p() before invoking malloc().
42*a7c91847Schristos The example thus becomes:
43*a7c91847Schristos size_t size = xsum (header_size, xtimes (n, element_size));
44*a7c91847Schristos void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
45*a7c91847Schristos */
46*a7c91847Schristos
47*a7c91847Schristos /* Convert an arbitrary value >= 0 to type size_t. */
48*a7c91847Schristos #define xcast_size_t(N) \
49*a7c91847Schristos ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
50*a7c91847Schristos
51*a7c91847Schristos /* Sum of two sizes, with overflow check. */
52*a7c91847Schristos static inline size_t
53*a7c91847Schristos #if __GNUC__ >= 3
54*a7c91847Schristos __attribute__ ((__pure__))
55*a7c91847Schristos #endif
xsum(size_t size1,size_t size2)56*a7c91847Schristos xsum (size_t size1, size_t size2)
57*a7c91847Schristos {
58*a7c91847Schristos size_t sum = size1 + size2;
59*a7c91847Schristos return (sum >= size1 ? sum : SIZE_MAX);
60*a7c91847Schristos }
61*a7c91847Schristos
62*a7c91847Schristos /* Sum of three sizes, with overflow check. */
63*a7c91847Schristos static inline size_t
64*a7c91847Schristos #if __GNUC__ >= 3
65*a7c91847Schristos __attribute__ ((__pure__))
66*a7c91847Schristos #endif
xsum3(size_t size1,size_t size2,size_t size3)67*a7c91847Schristos xsum3 (size_t size1, size_t size2, size_t size3)
68*a7c91847Schristos {
69*a7c91847Schristos return xsum (xsum (size1, size2), size3);
70*a7c91847Schristos }
71*a7c91847Schristos
72*a7c91847Schristos /* Sum of four sizes, with overflow check. */
73*a7c91847Schristos static inline size_t
74*a7c91847Schristos #if __GNUC__ >= 3
75*a7c91847Schristos __attribute__ ((__pure__))
76*a7c91847Schristos #endif
xsum4(size_t size1,size_t size2,size_t size3,size_t size4)77*a7c91847Schristos xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
78*a7c91847Schristos {
79*a7c91847Schristos return xsum (xsum (xsum (size1, size2), size3), size4);
80*a7c91847Schristos }
81*a7c91847Schristos
82*a7c91847Schristos /* Maximum of two sizes, with overflow check. */
83*a7c91847Schristos static inline size_t
84*a7c91847Schristos #if __GNUC__ >= 3
85*a7c91847Schristos __attribute__ ((__pure__))
86*a7c91847Schristos #endif
xmax(size_t size1,size_t size2)87*a7c91847Schristos xmax (size_t size1, size_t size2)
88*a7c91847Schristos {
89*a7c91847Schristos /* No explicit check is needed here, because for any n:
90*a7c91847Schristos max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX. */
91*a7c91847Schristos return (size1 >= size2 ? size1 : size2);
92*a7c91847Schristos }
93*a7c91847Schristos
94*a7c91847Schristos /* Multiplication of a count with an element size, with overflow check.
95*a7c91847Schristos The count must be >= 0 and the element size must be > 0.
96*a7c91847Schristos This is a macro, not an inline function, so that it works correctly even
97*a7c91847Schristos when N is of a wider tupe and N > SIZE_MAX. */
98*a7c91847Schristos #define xtimes(N, ELSIZE) \
99*a7c91847Schristos ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
100*a7c91847Schristos
101*a7c91847Schristos /* Check for overflow. */
102*a7c91847Schristos #define size_overflow_p(SIZE) \
103*a7c91847Schristos ((SIZE) == SIZE_MAX)
104*a7c91847Schristos /* Check against overflow. */
105*a7c91847Schristos #define size_in_bounds_p(SIZE) \
106*a7c91847Schristos ((SIZE) != SIZE_MAX)
107*a7c91847Schristos
108*a7c91847Schristos #endif /* _XSIZE_H */
109